With cross-account scanning, Agentless scanners are deployed across multiple regions in a single cloud account. The deployed Agentless scanners are granted visibility across multiple accounts without needing to perform cross-region scans, which are expensive in practice.

For larger accounts with 250 or more hosts, this is the most cost-effective option as it avoids cross-region scans, and reduces friction for managing your Agentless scanners. You can either create a dedicated account for your Agentless scanners or choose an existing one. The account where the Agentless scanners are located can also be scanned.

The following diagram illustrates how Agentless scanning works when deployed in a central cloud account:

With same account scanning, a single Agentless scanner is deployed per account. Although this can incur more costs, as it requires each Agentless scanner to perform cross-region scans per account, Datadog recommends this option if you do not want to grant cross-account permissions.

The following diagram illustrates how Agentless scanning works when deployed within each Cloud account:

1. Follow the setup instructions for adding AWS cloud accounts to Cloud Security Management.
2. On the Cloud Security Management Setup page, click Cloud accounts > AWS.
3. Click the Edit scanning button for the AWS account where you intend to deploy the Agentless scanner.
4. Enable Resource Scanning should already be enabled. Enable scanning for the cloud resources you want to monitor in the Agentless scanning section.
5. Follow instructions for Terraform setup.
6. Make sure the template runs successfully, then click Done to begin scanning.

1. On the Cloud Security Management Setup page, click Cloud accounts > AWS.
2. Click the Edit scanning button for the AWS account where you intend to deploy the Agentless scanner.
3. Enable Resource Scanning should already be enabled. Enable scanning for the cloud resources you want to monitor in the Agentless Scanning section.
4. Follow instructions for Terraform setup.
5. Make sure the template runs successfully, then click Done to begin scanning.

1. Set up the Amazon Web Services integration. You must also add the required permissions for resource collection.

   When you add a new AWS account, the following screen appears:

1. Click Yes under Enable Cloud Security Management, and enable scanning for the cloud resources you want to monitor in the Agentless scanning section.
2. Select an API key that is already configured for Remote Configuration. If you enter an API key that does not have Remote Configuration enabled, it will automatically be activated upon selection.
3. Click Launch CloudFormation Template. The template includes all the necessary permissions to deploy and manage Agentless scanners. The template must run successfully to receive scans.

1. On the Cloud Security Management Setup page, click Cloud accounts > AWS.
2. Click the Edit scanning button for the AWS account where you intend to deploy the Agentless scanner.
3. Enable Resource Scanning should already be enabled. Enable scanning for the cloud resources you want to monitor in the Agentless scanning section.
4. Go to your AWS console, create a new CloudFormation Stack using this template, and then run it.
5. Make sure the template runs successfully, then click Done to begin scanning.